CVE-2026-27014 NanZip has ROMFS Archive Infinite Loop / Stack Overflow
Attackers can cause application crashes via infinite loops or stack overflows in the ROMFS parser, requiring users to upgrade NanaZip.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-27014?
CVE-2026-27014 is a medium-severity denial of service vulnerability in M2Team NanaZip, published on 19 Feb 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
NanaZip is an open source file archive Starting in version 5.0.1252.0 and prior to version 6.0.1630.0, circular `NextOffset` chains cause an infinite loop, and deeply nested directories cause unbounded recursion (stack overflow) in the ROMFS archive parser. Version 6.0.1630.0 patches the issue.
Weakness: CWE-674
Which versions are affected by CVE-2026-27014?
It affects 1 product.
Products include M2team Nanazip.
How do I fix CVE-2026-27014?
No fix has been published for CVE-2026-27014 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-27014 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27014 exists.
Other vulnerabilities in M2Team NanaZip
- CVE-2026-26282 NanaZip has DotNet Single file OOB Heap Read
- CVE-2026-27709 NanaZip .NET Single-File Manifest Parser Vulnerable to Out-of-Bounds Read via Unchecked RelativePathLength
- CVE-2026-27710 NanaZip .NET Single-File Parser Integer Underflow Leads to Unbounded Allocation (DoS)
- CVE-2026-27711 NanaZip UFS Archive Parser Memory Corruption via Unvalidated Directory Record Length
- CVE-2026-27114 NanaZip has ROMFS Archive Infinite Loop
Sources
Also known as GHSA-fc89-3f57-h9q5.